SSL Certificate Checker: Expiry, Issuer, Chain, TLS
Pricing
Pay per event
SSL Certificate Checker: Expiry, Issuer, Chain, TLS
Check SSL/TLS certificates for any list of domains: days until expiry, issuer, whether it covers the host name, trusted chain, self-signed, TLS version, cipher, key type and all subject alternative names. Great for expiry monitoring on a schedule.
Pricing
Pay per event
Rating
0.0
(0)
Developer
Dodge Sucharda
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
22 days ago
Last modified
Categories
Share
Check the SSL/TLS certificate of any number of domains in one run: expiry date and days left, issuer, whether it covers the host name, whether the chain is trusted, self-signed certificates, TLS version, cipher, key type and every subject alternative name.
$1 per 1,000 hosts. Hosts that do not exist or refuse the connection are free.
Good for
- Expiry monitoring: schedule it daily or weekly on your domains and alert on
daysLeft(use Apify's schedules and integrations) - Agencies and IT teams: audit every client site at once
- Security reviews: find self-signed, mismatched or old-TLS endpoints
- Inventory: list which certificate authority each domain uses
Output (one row per host; real result from 30 Sep 2026, shortened)
{"host": "apify.com","port": 443,"status": "ok","valid": true,"daysLeft": 108,"validTo": "2027-01-16T23:59:59.000Z","issuer": "Amazon","issuerCommonName": "Amazon RSA 2048 M04","coversHost": true,"trusted": true,"selfSigned": false,"protocol": "TLSv1.3","keyType": "RSA 2048","sanCount": 4,"subjectAltNames": ["*.apify.com", "apifier.com", "*.apifier.com", "apify.com"],"issues": []}
valid is false when there is any error: expired, expiring within 7 days, not yet valid, host name not covered, self-signed, or an untrusted chain. expires_soon (within your warning window, default 30 days) and old TLS versions are warnings.
Input
- Hosts: domains or URLs, optionally with a port (
mail.example.com:993works for any TLS service). - Warn when expiring within (days): default 30.
Limits
- It reads the certificate the server presents for the host name you give (SNI). It does not scan every server behind a load balancer.
- It does not check revocation (OCSP/CRL).